Version of 19.10.2026
1. General provisions
1.1. This Privacy Policy (the "Policy") describes which personal data of users — (hereinafter "JOL", the "Operator", "we") processes, for what purposes, to whom the data is disclosed, how it is protected and how users can exercise their rights.
1.2. The Policy applies to the mobile apps "JOL" (for passengers and delivery senders) and "JOL Driver" (for drivers and couriers) for iOS and Android, their web versions and the website https://jolapp.asia (together, the "Service").
1.3. The Policy has been prepared in accordance with the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On Personal Data and Their Protection" (the "Personal Data Law") and other regulatory legal acts of the Republic of Kazakhstan (the "RK").
1.4. With respect to the personal data of the Service's users, JOL is the owner and the operator of the database containing personal data.
1.5. The Service is intended only for persons aged 18 or over. We do not knowingly collect personal data of persons under 18. If we learn that an account has been created by such a person, we may block and delete it.
1.6. The Policy is an integral part of the Public Offer for Passengers and Senders (https://api.jolapp.asia/legal/terms) and the Public Offer for Drivers and Couriers (https://api.jolapp.asia/legal/driver_terms). The current version of the Policy is published at https://api.jolapp.asia/legal/privacy and is available in the apps.
2. Definitions
- User — an individual using the Service: a Passenger, a Driver or a Courier.
- Passenger — a user of the "JOL" app who places an order for a ride or a delivery; when placing a delivery order, the Passenger is also the Sender.
- Driver — a user of the "JOL Driver" app who accepts ride orders.
- Courier — a Driver who has been granted access by JOL to orders under the "Delivery" tariff.
- Recipient — the person to whom a parcel is delivered.
- Order — an order for a ride or a delivery placed in the Service.
- Personal data, processing, depersonalization, cross-border transfer, authorized body — have the meanings given in the Personal Data Law.
3. What data we process
3.1. Data of all users
- email address;
- name;
- Google or Apple sign-in identifiers — if you choose that sign-in method;
- profile photo — optional;
- Order data: pickup and destination addresses, routes, saved places ("Home", "Work"), ride and delivery history, prices, payment method and status, bonuses earned and used;
- ratings and reviews;
- chat messages between the Passenger and the Driver during an active Order;
- requests and messages in the support chat;
- technical data: device push token, platform (iOS, Android, web), app version, IP address, technical logs of the Service.
3.2. Location
- Passenger: location is used only while you are using the app — to determine the pickup address and show nearby cars.
- Driver and Courier: location is transmitted while you are online, including when the app runs in the background — to offer you nearby Orders and to show the Passenger where the car is. When you go offline, location transmission stops.
- You can disable location access in your device settings, but the core features of the Service will then be unavailable.
3.3. Delivery data
When placing a delivery order, the Sender provides the Recipient's name and phone number and a description of the parcel.
3.4. Additional data of Drivers and Couriers
- first name, last name and phone number;
- driving licence number;
- vehicle data: make, model, colour, state registration plate;
- photos of documents (driving licence and vehicle registration certificate), which are reviewed by JOL staff;
- photos of the car outside and inside (car photo check), with the time and place they were taken — to make sure the car exists, matches the details given and is in proper condition. The photos are taken with the phone camera in the app and reviewed by JOL staff. The front photo of the car may be shown to the Passenger during a ride so they can recognise it;
- for Couriers — the individual identification number (IIN);
- payment details for receiving payments: bank and phone number, or a personal payment link;
- rating, history of accepted and completed Orders, bonus compensation balance and payout history.
3.5. What we do not process
- We do not accept payments and do not process bank card data: payment is made directly to the Driver.
- We do not use profile, document or car photos for biometric identification.
- We do not use advertising trackers and do not sell personal data.
4. Purposes of processing
4.1. We process personal data only to the extent necessary for the following purposes:
- registration, sign-in and account maintenance;
- placing Orders, matching a Driver, calculating and showing the price and route, showing the car's position;
- exchanging the necessary information between the parties to an Order, including chat during the Order;
- arranging direct payment to the Driver: showing the Driver's payment details and confirming payment;
- running the bonus program, accounting for compensation to Drivers and making payouts;
- verifying Drivers and Couriers at onboarding, granting delivery access, preventing blocked persons from registering again;
- user safety: the "Share trip" feature, handling complaints, preventing fraud and abuse;
- operating the support service, handling requests and disputes;
- sending sign-in codes and service push notifications about Order status, payment and bonuses;
- complying with the legislation of the RK, accounting and tax records, responding to lawful requests of government authorities;
- keeping the Service stable, diagnosing failures and improving the Service.
4.2. We do not send you advertising messages without your separate consent.
5. Consent to collection and processing
5.1. We collect and process personal data on the basis of your consent and in cases where the legislation of the RK permits processing without consent.
5.2. Consent is given electronically when you register in the Service, by confirming that you have read and accept the Policy and the relevant offer. We record the fact, date and version of the accepted documents.
5.3. By giving consent, you agree to the collection and processing of the data listed in section 3 for the purposes listed in section 4, to the disclosure of data to the persons listed in sections 6 and 7, and to the cross-border transfer of data in accordance with section 8.
5.4. Consent remains valid until the purposes of processing are achieved, until consent is withdrawn or until the account is deleted.
5.5. You may withdraw consent by contacting support or by deleting your account. Consent may not be withdrawn where withdrawal would contradict the legislation of the RK or where there is an unfulfilled obligation. After consent is withdrawn, further use of the Service becomes impossible.
5.6. When you provide data of another person (a passenger for whom you order a ride, or a delivery Recipient), you confirm that you are entitled to provide that data, that you have informed that person of its disclosure to JOL and the Driver, and that you have obtained their consent where the law requires it.
6. What the other party to an Order sees
- The Passenger sees: the Driver's first name and last-name initial, rating and photo, the car's make, model, colour and registration plate, the front photo of the car (if there is one), and the car's position on the map. For payment by transfer, the Passenger is shown the Driver's payment details: bank and phone number, or payment link.
- The Driver sees: the Passenger's first name, rating and photo, pickup and destination addresses, and the Order comment. The Passenger's phone number is not shown to the Driver.
- The Courier, after accepting a delivery Order, sees the Recipient's name and phone number and the parcel description.
- The "Share trip" feature. The Passenger may send a link to the ride to anyone. The link shows a map with the route and the car's live position, the ride status, the Passenger's first name, the Driver's first name and rating, and the car's model and registration plate. The link stops working 30 minutes after the ride ends, and the Passenger may revoke it earlier.
7. Disclosure to third parties
7.1. To operate the Service, we use the following service providers, which receive data only to the extent necessary to provide their services:
- hosting — the Operator's servers (—), including S3-compatible object storage for photos with the same hosting provider;
- 2GIS — maps, address search and route building: coordinates and addresses are sent;
- Google and Apple — sign-in with a Google or Apple account, if you choose that sign-in method;
- Google Firebase Cloud Messaging and Apple Push Notification service — delivery of push notifications: the device push token and the notification text are sent;
- email hosting provider — sending sign-in codes from no-reply@jolapp.asia: the email address and the message text are sent.
7.2. We disclose personal data to government authorities only in the cases and in the manner provided for by the legislation of the RK.
7.3. We do not sell personal data, do not share it with advertising networks and do not use advertising trackers.
8. Storage location and cross-border transfer
8.1. Users' personal data is stored in the Operator's database located at: —.
8.2. Some of the providers listed in section 7 (including Google and Apple) process data on servers outside the RK. Such transfer constitutes a cross-border transfer of personal data. Only the data needed for the relevant function is transferred outside the RK: for sign-in with Google or Apple — the data needed for sign-in; for push notifications — the push token and the notification text.
8.3. Cross-border transfer is carried out in accordance with the Personal Data Law: to states that ensure the protection of personal data, and to other states — on the basis of your consent given in accordance with section 5.
8.4. If you do not want your data to be transferred to Google or Apple for sign-in, use sign-in with a one-time code sent to your email. Push notifications can be disabled in your device settings.
9. Retention periods and account deletion
9.1. We keep personal data no longer than the purposes of processing require, unless a longer period is established by the legislation of the RK.
9.2. Account data is kept for as long as the account exists. Technical logs are kept for a limited period necessary for security and failure diagnostics.
9.3. You can delete your account in the app (Profile → Delete account) or on the web page https://api.jolapp.asia/account/delete with confirmation by a one-time code sent to your email. Deletion is not available while you have an active Order.
9.4. When an account is deleted:
- the name, email address, linked sign-in methods (Google, Apple), saved places, push tokens and profile photo are deleted;
- for Drivers and Couriers, the last name, phone number, driving licence number, IIN, payment details and the photos of documents and of the car are also deleted;
- bonuses are cancelled;
- records of completed Orders are kept in depersonalized form for accounting, tax and dispute purposes for the period established by the legislation of the RK.
9.5. Other data is deleted or depersonalized once the purposes of processing are achieved, unless its further storage is required by the legislation of the RK or for handling unresolved disputes and requests.
10. Protection of personal data
10.1. We take legal, organizational and technical measures to protect personal data from unlawful access, alteration, disclosure and destruction, including:
- data between the apps, the website and the servers is transmitted only over the secure TLS protocol;
- the IIN is stored encrypted, and a keyed hash, not the IIN itself, is used to detect repeat registrations;
- staff can view an IIN only when needed for their duties, and every such view is recorded in an audit log;
- staff access to administrative systems is protected by two-factor authentication, and staff actions are recorded in audit logs;
- access to data is granted only to staff who need it to perform their duties;
- we collect the minimum amount of data necessary.
10.2. In the event of a personal data security breach, we notify the authorized body within the time limits established by the legislation of the RK, take measures to remedy the consequences and, where provided for by the legislation of the RK, inform the affected users.
11. Rights of personal data subjects
11.1. You have the right to:
- know whether we hold your personal data and receive information about its processing;
- request that your personal data be amended and supplemented;
- request the blocking, deletion or destruction of personal data collected or processed in violation of the legislation of the RK;
- withdraw your consent to the collection and processing of personal data, except in cases provided for by the legislation of the RK;
- delete your account as described in section 9;
- receive an explanation of, and object to, a decision made about you using automated data processing, by contacting support;
- appeal against actions or omissions of the Operator to the authorized body for personal data protection (as of this version, the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan) or to a court.
11.2. You can change some of your data yourself in the app profile.
11.3. To exercise your rights, write to support@jolapp.asia or to the support chat in the app. We may ask you to confirm that the request comes from the account holder. We handle requests within the time limits established by the legislation of the RK.
12. Website and web versions
The website and the web versions of the apps may use strictly necessary cookies and browser local storage, for example to keep you signed in. No advertising trackers are used.
13. Changes to the Policy
13.1. We may change the Policy, for example when the Service's features or the legislation of the RK change. The new version is published at https://api.jolapp.asia/legal/privacy with its date.
13.2. We notify users of material changes in advance in the app or by email. If the changes require new consent, we will request it separately.
14. Contacts
Questions about the Policy and the processing of personal data, including requests to the person responsible for organizing personal data processing, may be sent to support@jolapp.asia, by phone at — or via the support chat in the app.
15. Company details
- Name: —
- BIN: —
- Address: —
- Email: support@jolapp.asia
- Phone: —
- Website: https://jolapp.asia